Text Encryption Tool

• Generate a random 16-byte salt (per encryption).
• Derive a 256-bit key with PBKDF2-HMAC-SHA256 from passphrase + salt, 600,000 iterations (OWASP 2023 recommendation for SHA256).
• Generate a random 12-byte IV (per encryption — AES-GCM IV is 96 bits).
• Encrypt plaintext with AES-256-GCM, producing ciphertext + 16-byte authentication tag.
• Concatenate salt + IV + ciphertext + tag, base64-encode, output.

To decrypt, the receiver parses the salt/IV out of the input, re-derives the key from the same passphrase, and runs GCM decrypt. If the authentication tag does not verify, decryption fails — no partial output, no "looks like garbage" fallback. This means an attacker cannot tamper with ciphertext undetected.

• AES-256 — symmetric block cipher, NIST-approved, fast on modern CPUs with AES-NI instructions (almost all x86 since 2011, ARM since v8.2-A). 256-bit key is overkill for foreseeable computing but standard practice.
• GCM mode — authenticated encryption. Produces a 16-byte tag that proves the ciphertext was not modified. Without authentication, an attacker can flip bits in ciphertext to corrupt plaintext predictably (CBC + no MAC = padding oracle attacks).
• Random IV per encryption — required by GCM. Reusing an IV with the same key catastrophically breaks the cipher (key recovery becomes trivial). 12-byte random IV gives 96 bits of randomness, safe up to ~2^32 encryptions per key.
• PBKDF2 with 600k iterations — slow on purpose. A 12-character passphrase has roughly 60-70 bits of entropy; PBKDF2 turns each guess into 600k SHA256 operations (~milliseconds on a CPU, hours on a GPU per million guesses). Bcrypt or Argon2id would be slightly better; PBKDF2 is what Web Crypto natively supports without polyfills.
• Salt per encryption — prevents pre-computed rainbow tables. Even if 10 million users encrypt "Hello" with passphrase "password", each ciphertext is unique because each salt is unique.

• You want to send a one-off secret to a friend over a channel that is convenient but not secure — Slack DM, email, SMS. Encrypt with a passphrase you communicate out-of-band.
• You are testing your own application's decryption logic against known ciphertext.
• You want a "lockbox" for a small note (recovery codes, off-the-grid contact info) that you can paste anywhere as ciphertext and decrypt later with a passphrase you remember.
• You are explaining authenticated encryption to a junior engineer and want a tangible demo of "wrong passphrase fails, modified ciphertext fails".

• It will not encrypt large files in the browser efficiently. Web Crypto AES-GCM has a 64GB-per-operation limit and reads the whole payload into memory. For multi-gigabyte files, use age, gpg, or openssl on the command line.
• It will not protect against malware on your device. If your machine is compromised, the passphrase you type is captured before encryption. The tool secures data in transit / at rest, not against endpoint compromise.
• It will not give you a key-exchange protocol. If you and the recipient cannot agree on a passphrase securely beforehand, you need public-key crypto (age, GPG, Signal) instead. Passphrase exchange over the same channel as ciphertext defeats the purpose.